Add a validator to check that PHP-TUF's Composer integration is present and configured correctly

We could make a validator and test and but then disable this validator in our base tests until the integration is done.

So we could have 1 test covers our validators

Assigning to @phenaproxima
re chat and

Should we just add `php-tuf/composer-integration` to our composer.json and be done with it?

He said this not a good idea

also
@adam.hoenich
were you thinking that in core we would add php-tuf to the core composer.json?
because if we didn't AU would not work "out of the box" and depending on product decisions PB won't either if required TUF

@phenaproxima thanks!

This sounds ok . I think the only downside is that people using AutoUpdates on 7.4 would not get Cron updates which is what most people want but that seems to be outweighed by

1. It would allow us to develop php-tuf now for how we would it included as a dependency of Drupal core, using the 8.1+ features, we won't have to put this work of
2. Requiring php-tuf because we think it is needed for extra security that cron updates require while at the same time allowing it to be run on php 7.4 we know will not get security updates seem like it would be giving sites a false sense of security

Assigning this to @Wim Leers to see if he sees any problem with this approach because I think as soon as we require 8.1 for php-tuf and start to use its features it would be a pain to downgrade.

I think for core yes should have php-tuf as a hard dependency because cron updates in the killer feature for core so having someone have to do another manual composer operation to get there seems not great.

We could also make it hard dependency of 3.x

Neither Automatic Updates nor Project Browser should have a hard dependency on PHP-TUF.

Core may require php-tuf when we merge in. @phenaproxima do you foresee and problems with this? I assuming we don't have any dependencies in php-tuf that core would not want to have an indirect dependency on, like we currently have in Au with composer/composer

Assigning to @phenaproxima for feedback on my idea in MR

Also setting to needs work because even if we don't decide to do any of the ideas I proposed I think at the very least we need to be clear in the messages the security implications. Probably also with @todo to follow-up issue that will provide a link to docs

RE: #3349368: [policy, no patch] How much of The Update Framework integration is needed for alpha-level review/commit of Package Manager?

We need TUF for package manager to get into core at all.

from this issues summary

(since we don't need to require TUF for attended Package Manager operations).

We should confirm that with a question in #3349368. It may be the case that all package manager operations need TUF or at least AutoUpdates and Project Browser.

re #3284443-11: Enable unattended updates I am removing unattended update blocker tag as I propose we don't block this in contrib only. But it is still an alpha target because we would need this in core for alpha

Re the current action that is needed is to make a new MR against 3.0.x from the current 8.x-2.x MR

I think we need "Needs issue summary update" before we do more work on this because of the changes made after this comment

re

I would prefer 2) because it would mean that by default all stages would enforce TUF validation. you would have to override this to opt of validation. Otherwise every stage has to opt-in for actual TUF enforcement and not just a warning.

We need to get confirmation from core committers that it is ok for modules building UIs to opt out TUF protect for their use case.

The reason I think it should be ok is otherwise if we make it too difficult to opt-out then I could see developers trying to do this by just removing our validator service altogether. That would be very bad because it would turn off TUF for all use cases

@Wim Leers on #36 you linked back to this issue. Did you mean to link to #3349368: [policy, no patch] How much of The Update Framework integration is needed for alpha-level review/commit of Package Manager??

re-assigning to @phenaproxima until tests pass

This looks good, but I will have to give it closer look. Didn't find anything I object to though

Just 1 suggestion for test coverage

Works for me